Privacy Policy
LAST UPDATE: October 26, 2026
This privacy notice for The San Francisco AI Factory Inc. (doing business as Factory) ("Factory," "we," "us," or "our"), describes how and why we might collect, store, use, and/or share ("process") your information when you use our services ("Services"), such as when you:
- Visit our website at factory.com, or any website of ours that links to this privacy notice.
- Engage with us in other related ways, including any sales, marketing, or events.
- Download, install, or use our applications (including, but not limited to desktop applications), web platform, extensions, and command-line interfaces (CLI).
Enterprise and Organizational Accounts
If you access or use Factory through an account provisioned by your employer or organization (an "Enterprise Customer"), this Privacy Policy does not apply to your workspace data.
In those contexts:
- Your organization is the Data Controller (or "Business"), and Factory acts strictly as a Data Processor (or "Service Provider") governed by your organization's Master Services Agreement (MSA) and Data Processing Addendum (DPA) or other agreements with Factory.
- Your organization’s administrators determine workspace settings, access controls, feature enablement, and retention rules.
- Our processing of workspace data, code, prompts, and session history is performed solely on behalf of and under the instructions of your organization.
- Please direct all questions, access requests, or deletion requests regarding enterprise data to your organization’s administrator.
1. Information We Collect
We collect information you provide directly, information collected automatically through your use of the Services, and information received from authorized third-party integrations.
| Category | Description |
|---|---|
| Account & Contact Information | Name, business email address, company name, role, login credentials, and communication preferences. |
| User Content | Inputs, prompts, code repositories, branch references, file contents, terminal or command inputs, session history, and outputs generated during your use of the Services. |
| Voice & Audio Input | Voice recordings and audio data if you enable or use voice-driven features, processed to generate transcriptions and commands. Audio files are deleted after transcription unless otherwise specified by your account settings or agreement. |
| Third-Party Integrations | Metadata, identifiers, and repository content retrieved from connected developer tools (e.g., GitHub, GitLab, Jira, Linear) authorized by you or your organization. |
| Device & Usage Telemetry | IP address, device type, browser specifications, operating system, diagnostic logs, performance metrics, and feature-interaction data collected automatically. |
| Communications & Support | Messages, feedback, inquiries, and bug reports submitted to our customer support or security teams. |
| Authentication & API Credentials | OAuth tokens, authentication credentials, and user-provided API keys (e.g., Bring Your Own Key / BYOK configurations). We store these credentials to authenticate your identity, facilitate integrations with third-party AI providers (e.g., OpenAI, Anthropic, GitHub), and enable remote compute and workflow execution on your behalf. |
We do not intentionally collect sensitive personal information (such as government IDs, health records, or biometric data) from standard accounts. Payment information is collected and processed directly by our third-party payment processors. If your organization intends to use the Services to process sensitive or regulated personal information (such as Protected Health Information), you must contact us to execute an enterprise agreement and appropriate contractual addenda (such as a Business Associate Agreement) prior to doing so.
2. How We Use Your Information
We process personal information only for legitimate business purposes and in accordance with applicable data protection laws:
| Purpose | Description | Legal Basis (EEA/UK) |
|---|---|---|
| Providing the Services | Authenticating users, routing model requests, executing requested tasks, maintaining platform operations, and facilitating payments. | Performance of Contract |
| Service Improvement & Analytics | Analyzing usage patterns, monitoring application performance, debugging issues, and improving core agent functionality and developer experience. | Legitimate Interests |
| Customer Support & Communications | Responding to technical questions, sending system alerts, notifying you of updates, and resolving customer issues. | Performance of Contract / Legitimate Interests |
| Safety & Security | Preventing fraud, detecting malicious or unauthorized activity, enforcing our terms, and securing our infrastructure. | Legitimate Interests / Legal Obligation |
| Legal Compliance | Meeting regulatory obligations, responding to lawful government or legal requests, and enforcing our agreements. | Legal Obligation |
| Marketing | Sending newsletters or promotional updates regarding new features. You may opt out at any time. | Consent |
Service Execution & AI Processing: To generate responses, execute workflows, and perform requested tasks, User Content is processed through our infrastructure and authorized third-party large language model (LLM) providers. Enterprise customers may configure data retention, isolation, and model-routing parameters pursuant to their customer agreements.
Google API User Data: Factory’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
International Transfers: We operate and process data primarily in the United States. If you access our Services from the European Economic Area, United Kingdom, or Switzerland, your information may be transferred to and processed in countries outside your jurisdiction. We rely on legally recognized transfer mechanisms, including the European Commission’s Standard Contractual Clauses (SCCs), to protect cross-border data transfers.
3. How We Disclose Your Information
We do not sell your personal data, and we do not share your personal data for cross-context behavioral or targeted advertising. We disclose information only under the following circumstances:
- Third-Party Service Providers: We work with vendors that support our core operations, including cloud infrastructure and web hosting (e.g., AWS, GCP), AI and LLM providers, identity verification, error logging, and payment processing. These providers process data only as necessary to perform services on our behalf and subject to strict confidentiality terms. For a complete, up-to-date list of our specific third-party subprocessors, the data they process, and their geographic locations, please visit our Trust Center at trust.factory.com.
- Enterprise Administrators: If you use an account provisioned by your employer or organization, designated workspace administrators have administrative access to that workspace. Depending on the organization's settings and permissions, administrators may view workspace usage metrics, session logs, and projects shared within the organization.
- Integrations and Collaboration: If you authorize third-party tools (such as GitHub, GitLab, Jira, Linear, or third-party AI providers) or use Bring Your Own Key (BYOK) features, your information and prompts will be shared with those third parties according to your settings and their respective privacy policies.
- Corporate Transactions: If Factory is involved in a merger, acquisition, financing, reorganization, or sale of assets, information may be transferred as part of that business transaction.
- Legal and Safety Requirements: We may disclose information if required by law, subpoena, or legal process, or if we believe in good faith that disclosure is necessary to protect the safety, property, or legal rights of Factory, our users, or the public.
4. Data Retention
We retain your personal information only for as long as necessary to fulfill the purposes outlined in this Privacy Policy, provide our Services, resolve disputes, and comply with legal obligations.
- For enterprise organizations, session retention and storage policies are configurable by workspace administrators.
- For standard accounts, account information is retained for the active life of your account.
- When information is no longer needed, we delete, anonymize, or aggregate it.
5. Security
We implement commercially reasonable technical, administrative, and physical safeguards designed to protect your personal information from unauthorized access, loss, alteration, or disclosure. However, no internet transmission or electronic storage system is completely secure, and we cannot guarantee absolute security.
6. Your Rights and Choices
Depending on your jurisdiction (such as California, the EEA, or the UK), you may have specific statutory privacy rights regarding your personal information:
- Access & Portability: Request a copy of the personal information we maintain about you in a structured format.
- Correction: Request corrections to inaccurate or incomplete information.
- Deletion: Request that we delete your personal information, subject to legal and operational exceptions.
- Opt-Out of Marketing: Opt out of promotional communications at any time using the "unsubscribe" link in our emails or by contacting us.
- Object or Restrict Processing: Object to or request limitations on certain types of data processing based on legitimate interests.
To exercise these rights, email us at privacy@factory.com. If you access Factory through an enterprise or employer-managed account, please direct your request directly to your workspace administrator, as Factory cannot modify enterprise records without authorization from the Data Controller.
7. Cookies
We use cookies and similar technologies to maintain user sessions, remember preferences, and analyze website traffic. You can adjust your browser settings to decline or delete cookies. Note that disabling essential cookies may prevent parts of the Services from functioning properly.
8. Minors’ Privacy
We do not knowingly collect, maintain, or use personal information from minors under 18 years of age, and no part of our Service(s) is directed to children. If you learn that a minor has provided us with personal information in violation of this Privacy Policy, then you may alert us at privacy@factory.com.
9. Updates
We may update this Privacy Policy periodically to reflect changes in our Services, technology, or legal requirements. When we make changes, we will update the 'Last updated' date at the top of this page. Your continued use of the Services after an update constitutes acceptance of the revised policy.
10. Contact Us
If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact our privacy team at:
The San Francisco AI Factory Inc.
Email: privacy@factory.com
Website: factory.com
